Cyber Resilience

CVE-2024-42911

HighRCE

Published: 14 January 2025

Published
14 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0232 85.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-42911 is a high-severity Code Injection (CWE-94) vulnerability in Ecovacs (inferred from references). Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-42911 is a WiFi Remote Code Execution vulnerability (CWE-94) in ECOVACS Robotics Deebot T20 OMNI and T20e OMNI devices running versions prior to 1.24.0. The issue allows attackers to execute arbitrary code over WiFi connections and carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network accessibility, high attack complexity, no privileges or user interaction required, and high impacts to confidentiality and integrity but none to availability.

Remote, unauthenticated attackers can exploit this vulnerability over the network by leveraging WiFi access to the affected devices. Successful exploitation enables full remote code execution, potentially allowing control over the robot vacuum's functions, data access, or further network pivoting depending on the executed code.

ECOVACS has published security advisory DSA20250113001 at https://www.ecovacs.com/global/userhelp/dsa20250113001 detailing the issue, with mitigation available by updating affected Deebot T20 OMNI and T20e OMNI devices to version 1.24.0 or later. Additional information is available at http://ecovacs.com.

EU & UK References

Vulnerability details

ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

RCE over network/WiFi with no auth directly enables remote service/app exploitation leading to code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-65294Shared CWE-94
CVE-2025-67113Shared CWE-94
CVE-2025-42957Shared CWE-94
CVE-2025-42950Shared CWE-94
CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94

Affected Assets

Ecovacs
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely flaw remediation through firmware update to version 1.24.0 directly eliminates the WiFi RCE vulnerability in affected Deebot devices.

SI-10 Information Input Validation good match
prevent

Validates all information inputs over WiFi connections to prevent the code injection (CWE-94) enabling remote code execution.

AC-18 Wireless Access partial match
prevent

Establishes authentication, encryption, and usage restrictions for wireless access, mitigating unauthorized WiFi exploitation vectors for this RCE.

References